Then again: If you open the announcement, you may well get nothing but an error message. DoSed? More like MS-DOSed! Of all things, the blog for a product that’s supposed to detect and fend off attacks is pretty much down and loads at a snail’s pace. Whether someone helped it along or too many Linux users just wanted to see it with their own eyes, I don’t know. Either way, a Defender for its own web server would be a good start.

And I had committed myself so firmly. When Sophos released a free virus scanner for Linux (in German) back in 2015, I cheekily wrote that you’re allowed to do online banking without a virus scanner. A few months later, in my article on AVG’s privacy policy (in German), I used the words snake oil. Eleven years later, I guess I owe the industry an apology. After all, Microsoft has spoken.

Microsoft discovers the Linux desktop

The real bombshell sits in the very first sentence of the announcement: “As more developers begin to use Linux desktops”. So Microsoft itself confirms that more and more people run Linux on the desktop. We Linux users have been cracking jokes about the Year of the Linux Desktop for decades. Now it’s proclaimed by none other than the company from Redmond. I never thought I’d read that confirmation in a press release for security software.

If you’ve been reading along for a while, you know the backstory. In 2009, Microsoft had to confess to the US Securities and Exchange Commission that Linux is officially a competitor (in German). In 2014, Microsoft then declared that as a server system, Linux “falls short” (in German). Today the company sells protection software for Linux servers and Linux desktops. So Gandhi was right, he just forgot the last stage: First they laugh at you, then they fight you, then they sell you a virus scanner.

What Defender can do on the Linux desktop

Technically, by the way, this isn’t new software at all. Microsoft uses the same agent it has been offering for Linux servers for a few years now. Defender figures out on its own whether it’s running on a server or a workstation. That’s real progress: In 2014, the Microsoft homepage still sold my Linux as Windows 8.1 (in German). Today Redmond can at least tell a server from a desktop.

On board are a “next-gen” virus scanner, endpoint detection and response (EDR), vulnerability management, and a device inventory. For emergencies, there’s Live Response and Device Isolation. In other words: Corporate IT gets a shell on your machine and can cut it off the network with a mouse click. Back in the day, we’d have called that a remote access trojan and hunted it down with ClamAV. Today it’s called enterprise-grade protection and comes with a license agreement.

Supported are RHEL, CentOS, Ubuntu, Debian, SLES, Fedora, and Oracle Linux, running Gnome, KDE, or any other desktop. That a security product of all things lists CentOS, which hasn’t received updates since 2024, has a certain charm. Arch Linux, on the other hand, is missing from the list. So sadly I remain unprotected – I use Arch, btw. And, to be perfectly honest, I’m a little relieved.

Who is this actually for?

You won’t find Defender as a package in your software center, and it’s certainly not free. You need Microsoft Defender for Endpoint Plan 2 or a Microsoft 365 E5 or E7 license. A Phoronix reader asked in the forum if someone could please translate these marketing terms into plain language. Happy to help: It’s not meant for your average Joe’s Linux. And anyway, it’s still in public preview.

All joking aside: Microsoft does have a point. Developer machines are hooked up to Git repos, CI/CD pipelines, and cloud accounts, and whoever breaks in there gets a grip on the entire supply chain. The real target audience, though, is compliance departments. They finally have a checkbox that lets them allow Linux notebooks in the company. Whether you’ll still be allowed to use sudo is another story. Microsoft already patented sudo back in 2009 (in German), after all.

The best summary came from a reader in the Phoronix forum: “Number of viruses on Linux: 1”. In my opinion, that hits the nail on the head. If you use Linux privately, install software from your distro’s repositories, and don’t blindly run every script from the internet with root privileges, you still don’t need a virus scanner. A Defender whose main job on Linux is hunting Windows malware won’t change that.

There’s just one punchline I can’t resist at the end. The German state of Schleswig-Holstein wants to throw Windows and Microsoft Office (in German) out of its administration and schools by the end of 2026. Right on the home stretch, Microsoft shows up at the door with the matching Defender for the new Linux machines. Who says Redmond isn’t flexible? What do you think: genuine care, telemetry, or just good business?

☕ Support Linux und Ich
Thanks for reading Linux und Ich. If you enjoy the blog and would like to support my work, you will find more information on the donation page.